@strifeapp/astro 1.2.0 → 1.4.0

package/dist/secrets-codec.d.ts

@@ -1,54 +0,0 @@
-/**
- * Codec for the single `STRIFE_SECRET` env var.
- *
- * Wire format (dot-separated, JWT-style): `v1.<meta>.<cert>`
- *   - `meta` = base64url(JSON.stringify({ urls, database, password?, type?, teamId?, previewSecret? }))
- *   - `cert` = base64url(<raw PFX bytes>)   — encoded ONCE (no double-base64)
- *
- * This module is the single source of truth for the format. The generation
- * script (encode) and the generated `strife:store` module (decode) both bind to
- * it. It is intentionally dependency-free (Node `Buffer` only) so the decode
- * logic runs on every Node-based runtime, including edge runtimes without
- * `node:zlib`. No compression, no encryption — base64url is encoding, not secrecy.
- *
- * Error messages carry only STRUCTURAL diagnostics — never the blob value, the
- * decoded meta, the certificate bytes, or the password (R7 no-leak): a decode
- * error can surface in an SSR log or error overlay.
- */
-export interface PackedSecrets {
-    urls: string[];
-    database: string;
-    /** Raw PFX bytes (NOT base64). RavenDB receives this Buffer directly. */
-    certificate: Buffer;
-    password?: string;
-    type?: string;
-    /**
-     * Team/workspace id. Matched against the `workspace` claim of a preview
-     * (edit-mode) token. Not secret on its own — an identifier, like an account
-     * number.
-     */
-    teamId?: string;
-    /**
-     * HMAC secret used to verify preview (edit-mode) tokens. Distinct in purpose
-     * from the DB certificate/password, but rides in the same blob so consumers
-     * configure a single var. Consumed by edit-mode.ts.
-     */
-    previewSecret?: string;
-}
-/** Thrown on a malformed blob. Messages are structural-only (no secret content). */
-export declare class SecretsDecodeError extends Error {
-    constructor(message: string);
-}
-export declare function encodeSecrets(secrets: PackedSecrets): string;
-/**
- * Decode a `STRIFE_SECRET` blob.
- *
- * @returns the packed secrets, or `null` when the blob carries a *known-shape*
- *   but unrecognised version (e.g. a future `v2`). `null` signals the caller to
- *   treat `STRIFE_SECRET` as unset and degrade to the four-var fallback chain,
- *   rather than aborting module init.
- * @throws {SecretsDecodeError} when the blob is malformed (wrong section count,
- *   no version prefix, bad base64url, invalid/incomplete JSON).
- */
-export declare function decodeSecrets(value: string): PackedSecrets | null;
-//# sourceMappingURL=secrets-codec.d.ts.map

package/dist/secrets-codec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets-codec.d.ts","sourceRoot":"","sources":["../src/secrets-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,oFAAoF;AACpF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAc5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CA0DjE"}